restore the checksum file during release

Signed-off-by: Alex Goodman <alex.goodman@anchore.com>

.goreleaser.yaml

@@ -57,6 +57,13 @@ archives:
       - syft-macos
 
 signs:
+  - artifacts: checksum
+    cmd: sh
+    args:
+      - '-c'
+      # we should not include the zip artifact, as the artifact is mutated throughout the next macOS notarization step
+      # note: sed -i is not portable
+      - 'sed "/.*\.zip/d" ${artifact} > tmpfile && mv tmpfile ${artifact} && gpg --output ${signature} --detach-sign ${artifact}'
   - id: syft-macos-signing
     ids:
       - syft-macos

Makefile

@@ -272,10 +272,10 @@ release: clean-dist ci-bootstrap-mac changelog-release ## Build and publish fina
 	echo "dist: $(DISTDIR)" > $(TEMPDIR)/goreleaser.yaml
 	cat .goreleaser.yaml >> $(TEMPDIR)/goreleaser.yaml
 
-	# release
+	# release (note the version transformation from v0.7.0 --> 0.7.0)
 	bash -c "\
 		BUILD_GIT_TREE_STATE=$(GITTREESTATE) \
-		VERSION=$(VERSION) \
+		VERSION=$(VERSION:v%=%) \
 		$(TEMPDIR)/goreleaser \
 			--rm-dist \
 			--config $(TEMPDIR)/goreleaser.yaml \